From e22dce6b5a51adf556fa6dd50fd856c8816593e1 Mon Sep 17 00:00:00 2001 From: Will Anderson Date: Sun, 26 Apr 2026 10:53:21 -0500 Subject: [PATCH] iam: grant ci-pusher run.developer for Cloud Run deploys --- servers/gcp/artifact-registry.tf | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/servers/gcp/artifact-registry.tf b/servers/gcp/artifact-registry.tf index 2791ccd..e7e5833 100644 --- a/servers/gcp/artifact-registry.tf +++ b/servers/gcp/artifact-registry.tf @@ -87,6 +87,16 @@ resource "google_artifact_registry_repository_iam_member" "ci_api" { member = "serviceAccount:${google_service_account.ci_pusher.email}" } +# ── CI pusher Cloud Run deploy permissions ──────────────────────────────────── +# The CI SA needs run.developer to deploy new revisions to Cloud Run. +# run.developer grants: services.get, services.update, revisions.list, etc. + +resource "google_project_iam_member" "ci_pusher_run_developer" { + project = var.project_id + role = "roles/run.developer" + member = "serviceAccount:${google_service_account.ci_pusher.email}" +} + # ── CI pusher JSON key (download once, store in Vault/Secret Manager) ───────── # After `terraform apply`, create a key and save it to GCP Secret Manager: # gcloud iam service-accounts keys create /tmp/ci-pusher.json \